phrush Casino Privacy Policy

This Privacy Policy ("Policy") is issued by phrush Casino ("phrush," "we," "us," "our") and applies to all personal data collected through the phrush online gaming platform accessible at phrush.cam (the "Platform"), including via the web interface, mobile browser, customer support channels, and any related communications.

phrush is committed to protecting the personal data of all registered players and Platform visitors in accordance with Republic Act No. 10173, the Philippine Data Privacy Act of 2012 ("DPA"), and its Implementing Rules and Regulations ("IRR"), as administered by the National Privacy Commission ("NPC").

This Policy should be read together with the phrush Terms & Conditions and the Responsible Gaming Policy. By registering a phrush account or using the Platform, you confirm that you have read and understood this Policy and consent to the processing of your personal data as described herein.

The data controller responsible for your personal data is phrush Casino, the operator of the Platform at phrush.cam. As data controller, phrush determines the purposes and means by which your personal data is processed.

For data privacy inquiries, requests to exercise your data subject rights, or any concern relating to how phrush processes your personal information, please contact our Data Protection Officer (DPO) using the details provided in Section 14 of this Policy.

phrush collects personal data that you provide directly, data generated by your use of the Platform, and data received from third-party service providers. The categories of personal data collected are as follows:

3.1 Data You Provide Directly

3.2 Data Generated by Your Use of the Platform

3.3 Data Received from Third Parties

phrush may receive supplementary personal data from KYC verification providers, payment processors (GCash, PayMaya, banking partners), fraud prevention and anti-money laundering (AML) screening services, and analytics partners. Such data is used solely for the purposes described in Section 4 of this Policy.

phrush processes your personal data for the following specific purposes:

• Account Registration and Management: To create and maintain your phrush player account, verify your identity, and enable access to Platform features;
• Payment Processing: To process deposits and withdrawal requests through GCash, PayMaya, BPI, BDO, Metrobank, and 7-Eleven; to reconcile transactions and manage your account balance;
• Identity Verification (KYC): To verify your identity, age (mandatory 21+ requirement), and source of funds in compliance with PAGCOR regulations and applicable Philippine AML laws;
• Service Delivery: To provide access to casino games, sports betting, bingo, live casino, bonus programs, loyalty rewards, and all other Platform features;
• Security and Fraud Prevention: To detect, investigate, and prevent fraudulent activity, unauthorized account access, money laundering, and other prohibited conduct described in the phrush Terms & Conditions;
• Regulatory Compliance: To fulfill obligations under the Data Privacy Act, PAGCOR regulations, Anti-Money Laundering Act (AMLA), and other applicable Philippine laws;
• Customer Support: To respond to your queries, complaints, and requests through live chat and email support;
• Responsible Gaming: To monitor gaming patterns for indicators of problem gambling behavior and administer responsible gaming tools such as deposit limits, cooling-off periods, and self-exclusion;
• Platform Improvement: To analyze usage patterns and technical performance data to improve the phrush Platform, user experience, and game offering;
• Marketing Communications: To send promotional offers, bonus notifications, and Platform updates to players who have opted in to marketing communications. You may withdraw this consent at any time.

Under the Philippine Data Privacy Act of 2012 and its IRR, phrush processes your personal data on the following legal bases:

• Consent (Section 12(a), DPA): For marketing communications, optional analytics cookies, and any processing activity for which you have provided explicit consent at the time of collection. Consent may be withdrawn at any time without affecting the lawfulness of prior processing;
• Performance of Contract (Section 12(b), DPA): For all processing necessary to create and operate your phrush account, process deposits and withdrawals, and deliver Platform services;
• Compliance with Legal Obligation (Section 12(c), DPA): For KYC/AML verification, age verification, transaction reporting, and any other processing required by PAGCOR, the Anti-Money Laundering Council (AMLC), the NPC, or other regulatory authorities having jurisdiction;
• Legitimate Interests (Section 12(f), DPA): For fraud prevention, Platform security, responsible gaming monitoring, and internal analytics — where phrush's legitimate interests do not override your fundamental rights and freedoms.

phrush does not sell, rent, or trade your personal data to any third party for their own marketing purposes. Personal data is shared only in the following circumstances and with the following categories of recipients:

• Payment Processors: GCash (Mynt / Globe Fintech Innovations), PayMaya (Voyager Innovations), BPI, BDO, Metrobank, and 7-Eleven payment partners — to execute your deposit and withdrawal requests;
• KYC & Identity Verification Providers: Third-party services used to verify government-issued IDs and perform age and identity checks required under PAGCOR and AML regulations;
• Fraud Prevention & AML Service Providers: Screening services used to detect suspicious transactions and ensure compliance with the Anti-Money Laundering Act;
• Game Software Providers: Licensed game studios (e.g., Pragmatic Play, PG Soft, Habanero) receive limited technical data necessary to deliver game sessions. These providers do not receive your personal identity or financial data;
• Regulatory Authorities: PAGCOR, the AMLC, the NPC, and any other Philippine regulatory or law enforcement body where disclosure is required by law, court order, or regulatory directive;
• IT & Platform Infrastructure Providers: Cloud hosting, cybersecurity, and Platform support vendors operating under strict data processing agreements that prohibit any use of your data beyond the specified service delivery purpose.

phrush uses cookies and similar tracking technologies on the Platform to ensure its proper functioning, remember your preferences, prevent fraud, and — with your consent — collect analytics data to improve the Platform.

Types of Cookies Used by phrush

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies may affect Platform functionality and your ability to remain logged in to your phrush account.

phrush retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

• Active Account Data: Retained for the duration of your active phrush account relationship plus a minimum of five (5) years following account closure, as required under Philippine AML and gaming regulations;
• KYC and Identity Verification Documents: Retained for a minimum of five (5) years from the date of verification, or from the date of account closure, whichever is later;
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, in compliance with AMLC record-keeping obligations;
• Customer Support Correspondence: Retained for three (3) years from the date of the interaction;
• Marketing Consent Records: Retained for the duration of your account plus three (3) years to document opt-in and opt-out history;
• Analytics Data: Aggregated and anonymized after twenty-four (24) months from collection.

Upon the expiry of the applicable retention period, phrush will securely delete or irreversibly anonymize your personal data in accordance with NPC-recommended data disposal standards.

phrush implements technical and organizational security measures appropriate to the risk profile of the data processed on the Platform. These measures include:

• Transport Encryption: All data transmitted between your device and phrush servers is encrypted using TLS 1.2 or higher (256-bit SSL), verified by a trusted certificate authority;
• Data Encryption at Rest: Sensitive personal and financial data stored on phrush servers is encrypted using AES-256 encryption;
• Access Controls: Access to personal data is strictly limited to phrush personnel and authorized third-party processors who require the data to perform their designated functions. Role-based access control (RBAC) is enforced across all internal systems;
• Password Security: Player passwords are stored as salted cryptographic hashes — phrush never stores plaintext passwords;
• Two-Factor Authentication: 2FA is available and encouraged for all phrush accounts to protect against unauthorized access;
• Security Monitoring: The phrush Platform is subject to continuous security monitoring, intrusion detection, and regular vulnerability assessments by qualified security professionals.

Under the Philippine Data Privacy Act of 2012, you hold the following rights with respect to your personal data processed by phrush. You may exercise these rights by contacting the phrush DPO using the details in Section 14:

phrush will acknowledge your rights request within seventy-two (72) hours and endeavor to respond substantively within fifteen (15) calendar days, as required under NPC guidelines. In complex cases, this period may be extended with notification to you.

The phrush Platform is strictly restricted to individuals who are 21 years of age or older, consistent with the minimum gambling age prescribed under PAGCOR regulations for casino-style gaming in the Philippines.

phrush does not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory step in the KYC process before any withdrawal can be processed. If phrush becomes aware that personal data has been collected from a person under 21, the relevant account will be immediately closed, all associated personal data will be deleted (subject to any regulatory retention obligations), and any funds will be returned in accordance with applicable regulations.

The phrush Platform is primarily operated for players based in the Philippines. However, certain third-party service providers — including cloud infrastructure providers, KYC verification platforms, and game software studios — may process personal data in jurisdictions outside the Philippines.

Where personal data is transferred outside the Philippines, phrush ensures that appropriate safeguards are in place in accordance with Section 21 of the DPA and the NPC's guidelines on cross-border data transfers, including:

• Binding contractual clauses (data processing agreements) with receiving entities that impose obligations equivalent to Philippine DPA standards;
• Transfers only to jurisdictions or entities that provide an adequate level of protection for personal data as assessed by phrush's DPO;
• Application of additional technical safeguards (encryption, pseudonymization) where the destination jurisdiction's legal framework is assessed to be less protective than the Philippine DPA.

phrush reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, Platform features, or applicable law. Material changes to this Policy will be communicated to registered phrush players via email to the address on file and by a notice on the Platform, not less than seven (7) calendar days before the changes take effect.

The effective date of the current version of this Policy is shown at the top of this page. Your continued use of the phrush Platform after the effective date of any amendment constitutes your acknowledgment of and agreement to the revised Policy. If you do not agree with any amendment, you may request account closure in accordance with the phrush Terms & Conditions.

Previous versions of this Policy are available on request by contacting the phrush DPO. phrush recommends that you review this Policy periodically.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by phrush, please contact our Data Protection Officer (DPO) through the following channels:

• Privacy / DPO Email: [email protected] — please mark your subject line "PRIVACY REQUEST" or "DATA SUBJECT RIGHTS" for priority routing to the DPO team
• General Support & Live Chat: Available 24/7 within the phrush Platform — average response time under 90 seconds
• Email Response Time: Acknowledgment within 72 hours; substantive DPA response within 15 calendar days

If your concern is not resolved to your satisfaction by phrush's DPO, you have the right to escalate your complaint to the National Privacy Commission (NPC) of the Philippines, which is the regulatory body responsible for administering and enforcing the Data Privacy Act of 2012.